Minimum permissions for a plumbing software connection

The decision to make first

A connection may ask for broad account access even though the pilot only needs to create a limited service-inquiry record. Identify the precise read and write actions required, then have the account owner approve the narrowest practical permission set.

What the handoff should contain

Document the connected account, permitted objects, prohibited actions, credential owner and the process for removing access when the pilot ends.

Suggested wording to approve

Example wording: “The pilot connection is intended to pass approved inquiry fields. It should not alter invoices, customer permissions or unrelated job records.”

Test the difficult case

Test the allowed inquiry action and a deliberately disallowed action in an approved test context to confirm the boundary is enforced. Do not place administrative credentials in website code, downloadable examples, chat messages or screenshots used to demonstrate the integration.

Worked example

Fictional example: The pilot needs to create inquiry records but not modify invoices. In the approved test account, creating a fictional inquiry should work while an invoice-changing action remains unavailable. If both succeed with an administrator key, reduce the permission scope or document why a different connection approach is needed before production use.

Review it in operation

Review access after changes to staff, vendors or pilot scope and remove credentials that no longer have an operational owner.

Check before you launch

• Identify the precise read and write actions required, then have the account owner approve the narrowest practical permission set.
• Document the connected account, permitted objects, prohibited actions, credential owner and the process for removing access when the pilot ends.
• Test the allowed inquiry action and a deliberately disallowed action in an approved test context to confirm the boundary is enforced.
• Review access after changes to staff, vendors or pilot scope and remove credentials that no longer have an operational owner.

Related guides